PDF to Markdown - Extract Text, Tables, Formulas from PDF

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:03 AM UTC
• Version: 1.0.4

Overview

This PDF-to-Markdown skill is coherent and purpose-aligned, but users should know that documents are sent to MinerU's external API and that the helper CLI is installed from unpinned third-party package sources.

Install only if you are comfortable using MinerU's external API for PDF conversion. Do not submit confidential PDFs unless that data flow is acceptable to you, and prefer a trusted, pinned installation of mineru-open-api when possible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5

Finding

Unpinned Third-Party CLI Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 5
Vulnerability Type: Supply-chain risk from mutable, unverified dependencies
Risk Level: Medium

Vulnerable Code

yaml

metadata: {"openclaw":{"emoji":"📄","requires":{"bins":["mineru-open-api"]},"install":[{"id":"npm","kind":"node","package":"mineru-open-api","bins":["mineru-open-api"],"label":"Install via npm"},{"id":"uv","kind":"uv","package":"mineru-open-api","bins":["mineru-open-api"],"label":"Install via uv"},{"id":"go","kind":"go","package":"github.com/opendatalab/MinerU-Ecosystem/cli/mineru-open-api","bins":["mineru-open-api"],"label":"Install via go install","os":["darwin","linux"]}]}}

Technical Analysis

The installation metadata references packages from the npm, Python/uv, and Go ecosystems without pinning reviewed versions, immutable commit hashes, checksums, or signatures. Installation therefore resolves mutable package identifiers whose contents may change after this Skill has been audited.

The Skill also does not provide evidence that the npm and Python packages are controlled by the owner of the referenced Go repository. This creates exposure to compromised registry releases, maintainer-account takeover, dependency confusion, or package-name ownership problems. Package installation hooks or a subsequently invoked mineru-open-api executable could run attacker-controlled code.

Attack Path

1. An attacker compromises a maintainer or registry account associated with one of the referenced package names, or otherwise gains control of its resolved release.
2. The attacker publishes a malicious release under the unchanged mutable package identifier.
3. A user or automated Skill installer resolves and installs that release because no trusted version, digest, or commit is specified.
4. Malicious installation hooks execute during installation, or the malicious mineru-open-api binary executes when the Skill processes a PDF.
5. The pa ...[truncated 581 chars]

Remediation

View remediation

Remediation Suggestions

• Pin every dependency to a reviewed, exact version. For Go installation, use an immutable reviewed version or commit rather than an unqualified module path.
• Record and verify cryptographic checksums or trusted signatures for downloaded artifacts.
• Confirm and document that packages in all three registries are published by the same trusted project owner.
• Prefer one verified distribution channel instead of maintaining several unauthenticated alternatives.
• Disable package installation scripts where supported and unnecessary.
• Run installation and document conversion with least privilege in a sandbox or container, restricting filesystem and network access.
• Establish an update process that reviews and tests each new dependency version before changing the pin.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The quick-start section presents local-file and URL examples before clearly warning that documents are transmitted to the MinerU API for processing. Because the tool handles potentially sensitive local PDFs and remote document links, this omission can lead users to disclose confidential data to an external service without informed consent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill recommends activation based on broad verbs like 'read', 'extract', 'convert', and 'parse', which are common in many benign document tasks. This can cause overbroad invocation and route user content to this skill, increasing the chance that local files or remote PDFs are sent to a third-party API without the user realizing that external transmission will occur.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.